docs(security): note shared SA privilege on Jobs (OSPRH-32425 / FIND-…

components/argocd/hooks/postDelete/controlplane/controlplaneCleaning.yaml

@@ -11,6 +11,12 @@ metadata:
 spec:
   template:
     spec:
+      # NOTE (FIND-013 / OSPRH-32425): This post-delete hook runs as the shared ArgoCD
+      # SA which carries the full gitops-openstack ClusterRole. The hook is an example
+      # pattern for CI/lab environments; it only needs delete on openstackcontrolplanes
+      # in the openstack namespace. For production use, replace with a dedicated SA
+      # bound to a minimal Role scoped to that single verb/resource/namespace, and set
+      # automountServiceAccountToken: true only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller
       restartPolicy: Never
       securityContext:

components/argocd/hooks/postDelete/dataplane/OpenStackDataPlaneService-deletion.yaml

@@ -11,6 +11,12 @@ metadata:
 spec:
   template:
     spec:
+      # NOTE (FIND-013 / OSPRH-32425): This post-delete hook runs as the shared ArgoCD
+      # SA which carries the full gitops-openstack ClusterRole. The hook is an example
+      # pattern for CI/lab environments; it only needs delete on openstackdataplaneservices
+      # in the openstack namespace. For production use, replace with a dedicated SA
+      # bound to a minimal Role scoped to that single verb/resource/namespace, and set
+      # automountServiceAccountToken: true only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller
       restartPolicy: Never
       securityContext:

components/argocd/hooks/postDelete/deploy-operators/observability-csv.yaml

@@ -11,6 +11,12 @@ metadata:
 spec:
   template:
     spec:
+      # NOTE (FIND-013 / OSPRH-32425): This post-delete hook runs as the shared ArgoCD
+      # SA which carries the full gitops-openstack ClusterRole. The hook is an example
+      # pattern for CI/lab environments; it only needs delete on ClusterServiceVersions
+      # in openshift-operators. For production use, replace with a dedicated SA bound
+      # to a minimal Role scoped to that single verb/resource/namespace, and set
+      # automountServiceAccountToken: true only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller
       restartPolicy: Never
       securityContext:

components/utilities/approve-installplan/job.yaml

@@ -174,4 +174,13 @@ spec:
 
               log "Job completed successfully."
       restartPolicy: Never
+      # NOTE (FIND-013 / OSPRH-32425): This Job runs as the shared ArgoCD SA which
+      # carries the full gitops-openstack ClusterRole. The approve-installplan pattern
+      # is a CI/lab convenience to handle Manual installPlanApproval without human
+      # intervention; it is not intended for production environments. When OLM v2
+      # (ClusterExtension API) becomes standard, InstallPlan approval is replaced by
+      # version pinning in Git and this Job will no longer be needed. For production
+      # use, create a dedicated SA bound only to a Role granting get/list/patch on
+      # installplans in the target namespace, with automountServiceAccountToken: true
+      # only on the Job pod spec.
       serviceAccountName: openshift-gitops-argocd-application-controller